Bell Measurement and Local Measurement in the Modified Lo-Chau Quantum Key 

Distribution Protocol 
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We clarify the argument on the how (nonlocal) degenerate Bell measurement can be replaced 
by local measurements in the modified Lo-Chau quantum key distribution protocol. Discussing 
security criterion for users, we describe how eavesdropper's refined information on the final state 
is not helpful. We argue that current discussions on the equivalence of the Bell and the local 
measurements are not clear. We show how the problem of equivalence can be resolved using the 
fact that eavesdropper's refined information is not helpful for her. 
PACS: 03.67.Dd 



I. INTRODUCTION 

Quantum cryptography, moreprecisely, quantum key 

distribution (QKD) [ltlIHSlHE0lEl!El, isone 
of the most promising protocols in quantum information 
processing ll]. Bennett-Brassard 1984 (BB84) QKD 
protocol [lj had been widely conjectured to be secure 
based on the quantum no-cloning theorem [TH, fill ITfij 
before its security was shown by a few authors recently 
However, Refs. 2 and 3 seem to be too compli- 
cated to be widely understood while Ref. 4 is relatively 
simple in that it makes use of tools that are familiar to 
quantum information scientist, e.g. quantum error cor- 
recting code (QECC) and entanglement distillation pro- 
tocol (EDP). Thus, the approach of Shor and Preskill Q 
is being more widely accepted and applied to deal with 
the security of variations of the BB 84 protocols 0, 0] . 

In Ref. 4, the authors argue that the modified Lo- 
Chau (LC) protocol based on the EDP is secure. Then, 
they show that the modified LC protocol reduces to the 
BB84 protocol. Thus, the security of the BB84 proto- 
col depends on that of the modified LC protocol. In the 
discussion on security of the modified LC protocol, they 
use 'classicalization of statistics' (or 'quantum to classi- 
cal reduction') 0, [fj. However, in the derivation of the 
classicalization of statistics, they make use of a (partial) 
equivalence between (degenerate) Bell measurements and 
local measurements: Bell measurements can be replaced 
by Z measurement in the |0), |1) basis and by X measure- 
ment in the |0),|1) basis. Here, a Bell measurement is 
one in the Bell basis = (1/ v / 2)(|0)a|0)b ± \1)a\1)b) 
and - (1/V2)(|0) a |1)b ± \1)a\0)b), where A_&nd 

B denote two users, Alice and Bob, respectively. |0) = 
(1/V2)(|0) + |1» and |1) = (1/V2)(|0) - |1». (The Y 
measurment is the one in the basis |6) = {1/V2)(\0) + 
i\l)) and |1) = (X/V2)(j0> - However, the discus- 

sion on the equivalence is not clear as we will see. On 
the other hand, the security considered so far has been 
that from Eve's (eveasdropper's) point of view. However, 
what we eventually need is a security criterion for Alice 



and Bob, the users. 

The purpose of this paper is to give a clearer presen- 
tation for the equivalence between the Bell and the local 
measurements in the modified LC protocol. While dis- 
cussing security criteria for Alice and Bob, we show that 
Eve's refined information on the final state is not helpful 
to her. Then, we clarify the equivalence between Bell 
measurements and Z and X measurements. 

This paper is organized as follows: First, we reformu- 
late the modified LC protocol and arguments for its se- 
curity in an explicit manner. Next, briefly discussing 
security criteria for Alice and Bob, we show that Eve's 
refined information on the final state is not helpful to her. 
Then, we argue that the current discussions on the equiv- 
alence of the Bell and local measurements are not clear, 
and we show that the problem of the equivalence can be 
resolved using the fact that Eve's refined information is 
not helpful to her. 



II. MODIFIED LO-CHAU PROTOCOL 

The legitimate states in the modified LC protocol are 
pairs of a Bell state, |$ + ). However, the whole quantum 
state that Alice, Bob, and Eve share, after distribution of 
quantum bits (qubits) and before entanglement distilla- 
tion, is an arbitrary state \iPabe) that Eve chooses. Let 
us write down the state \4>abe) in the Bell basis: 
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Here, {k} is an abbreviation for k\, fe, fen with fcj = 
0,1,2,3 (i = 1,2, ...,2n), and cto = I, o\ = X, 02 — 
Y , (73 = Z are Pauli operators. The owo denotes the 
Pauli operator cr^ acting on zth qubit of Bob. Namely, 
(Tfc i (j) is / <g> (Tfe; acting on zth qubit pairs that are shared 
by Alice and Bob. Note that the set of crk 1 (i)&k 2 (2) ■ ■ ■ 
cr fe 2 „(2n)l <i)+ )' 812 " °f au M constitutes the complete Bell 
basis for the 2n qubit pairs. The Crj.}'s are coefficients 
in complex numbers. Eve's states |-E{fc}) are normalized, 
but not mutually orthogonal in general. It is notable 
that the state in Eq. QJ is completely general; thus, it 
is dealing with all attacks including opaque (intercept- 
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resend), individual, collective, and joint attacks 

Let us describe the checking method. Consider a mea- 
surement Mz whose projection operators are 

P = |*+)<*+| + |*-)<*-| = |00)<00| + |ll)(ll|, 
Pi = |* + >(*+| + = |01)(01| + |10)(10|.(2) 

Also, consider a measurement Mx whose projection op- 
erators are 

P = |$+)(*+| + |*+)(*+| = |60)(00H-|lI)<ll|, 
Pi = |$-)<$-| + |*-)<*-| = |01)(01| + |10)<10|.(3) 

The measurements Mz and Mx are nonlocal. (For ex- 
ample, P o |00) = (1/V2)P (|$+) + |$-» = (1/V§)|$+); 
that is, a separable state |00) is transformed to a nonlocal 
state Thus, obviously they cannot be performed 

by Alice and Bob who are supposedly separated. How- 
ever, we assume that they can perform the measurements 
Mz and Mx for the time being. We will see later how 
Mz and Mx can be replaced by separable measurements 
Z and X. 

The error rate in the modified LC protocol is defined 
as follows: First Alice and Bob randomly choose n pairs 
of qubits from among the In pairs. On each of the n cho- 
sen pairs, they perform a measurement randomly chosen 
between Mz and Mx ■ The error rate e is the number of 
all instances when the measurement outcomes are those 
corresponding to Pi and Pi divided by the number of 
samples n. From Eqs. and @, we can see that the 
legitimate state has zero probability to give rise to 
an error, and that other illegitimate states, |$ _ ), |^ + ), 
and have non-zero probabilities, 1/2,1/2, and 1, 

respectively, to give rise to an error. 

Let us now describe the 'classicalization of statistics' 
[jjlij. We consider a case n — 2, which is simple but il- 
lustrative enough. Assume that Alice and Bob's random 
choice was to measure the first and the third pairs in the 
Z and the X bases, respectively. That is, they perform a 
measurement Mz <8> I ® Mx <8> / on a state \4>'abb) = 
C{fc}C r fc 1 (i)crfc 2 (2)0-fc 3 (3)C r fc 4 (4)|* + )® 4 |P{fe})- It is 
easy to see that, for example, the probability poo 
that they get in the Mz measurement and 
in the Mx measurement is given by poo — 
£fci=o,3,fe,,fes=o,i,fc« l^ml 2 ' where fc 2,fc 4 = 0,1,2,3. 
The resultant state is |V>oo) = NJ2 ki =o,3,k 2 M=o,iM 
C{fe}CTfc 1 (i)crfc 2 (2)0-fe3(3)0-fe 4 (4)l < S + >® 4 |P{fc}>, where N = 
1 /Efc 1 =o,3,fc 2 ,fc 3 =04,fc4 l^ml 2 is the normalization con- 
stant. (Note Eqs. @ and and that (I® a 3 )\$ + ) = 
|$~) and (7® ai)\$ + ) = \^ + )-) In the same way, we 
can calculate the probabilities poi, Pio, and pn and 
the corresponding resultant states. Then, let us con- 
sider a case where Eve prepares a mixed state p' — 

T,{k} P {k}0-k 1 (l)CTk 2 (2)Crk 3 (3)^k i (4) |$+)® 4 

($ + |® 4 CT fcl (i)CT fc2( 2)CT fc 3(3)cr fe4 ( 4) , where P {k} EE |C {fe} | 2 . 
We consider the case where Alice and Bob perform 
the same checking measurement Mz C3) / <g> Mx ® I 
on the state p' . Then, it is easy to see that, for 



example, the probability g o that they get in the 
Mz measurement and in the Mx measurement is 
the same as the poo given above. However, the re- 
sultant state is not the same, but is given by p' 00 = 

N J2k 1= 0,3,k 2 M=0,lM P {fc} fJ fei(l) Cr fe2(2)C r fe3(3)^fe4(4)l* + ) 04 

($+ 1 m a kl (i) CT fe2 ( 2 ) a k3 ( 3 ) a ki (4 ) . Note a similarity between 
the states \tp' 00 ) and p' QQ . The difference is that the for- 
mer is full superpositions that are partially broken in the 
latter. In both cases, the only states that are compatible 
with the measurement outcomes remain with the relative 
magnitude of Ci k \'s and Pjfcj's preserved. In the same 
way, we can calculate p' 01 , p' w , and p' lx that also turn out 
to be the same as p$\, pio, and pn, respectively, and we 
obtain the corresponding resultant states. It is straight- 
forward to generalize the calculations to the general n 
case. If the similarity in the resultant states is used, it is 
not difficult to see the classicalization of statistics [f| @ : 
For each state \iPabe) in Eq. there exists a corre- 
sponding state 

P = ^2 P {k} Oft! (l)°fc 2 (2) ' ' ' ^k 2n (2n)\^ + )® 2n 

{k} 

^ + r 2n <J kl(1) a k2{2 ya k2n{2n) (4) 

that has the following properties: First, the state gives 
rise to the same statistics for the checking measurement 
and, thus, has the same probability to pass the test as 
those of the state \i(jabe)- Second, when it passes the 
test, the resultant states give rise to, after the EDP, a 
state that has the same fidelity as the legitimate states, 
as in the case of the state \i/jabe)- It is the fidelity of 
the final state S(pab) to the legitimate state that bounds 
Eve's information on the final key, as seen below. Thus as 
far as the security is concerned, the two states in Eqs. 
and 10} are equivalent. The classicalization of statistics 
plays a crucial role in showing the security in that it 
removes some entanglement in the state of Eq. Q that 
is otherwise intractable for Alice and Bob. 

Now let us see how the fidelity of the final state of Alice 
and Bob to the legitimate state bounds Eve's information 
on the final key [a, @ • Eve knows the initial state that 
she prepared, and she knows the identities of all quan- 
tum processing that has been done on the initial state, 
including identities and outcomes of measurements, and 
a chosen QECC because they are publicly announced. 
Therefore, Eve can calculate the final (pure) state pabe 
that Alice, Bob, and herself share. Alice and Bob's state 
Pab and Eve's state p E are given by pab = ^e(pabe) 
and pe — ^ab(pabe), respectively. Eve's von Neumann 
entropy S(pe) = — tr(p^ log pe) is the same as Alice and 
Bob's S(pab) because pabe is a pure state. On the other 
hand, it can be observed 0, @ that the mutual infor- 
mation between Eve's party and Alice and Bob's party, 
I(AB; E), is bounded by Holevo's theorem 

I(AB;E)<S(pe) = S(pab)- (5) 

However, S(pab) is bounded by the fidelity of the state 
Pab to the legitimate state 0, |g| . 
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Let us discuss the arguments for security of the modi- 
fied LC protocol. Assume that Eve distributed the state 
in Eq. Q to Alice and Bob. Due to the classicalization 
of statistics, however, it is sufficient for them to consider 
a corresponding case where Eve distributed the state in 
Eq. Thus, first we may well separately consider each 
term 

0*1(1) cr fe2 ( 2 ) • • • fTfc 2ii ( 2 „)|$ + )® 2 ™ 

(<£ + \® 2n a kl(1) a k2{2 ya k2n(2n) (6) 

with a particular {fc} and then combine them later. Con- 
sider the checking measurement where n randomly cho- 
sen pairs are measured along randomly chosen bases. We 
can see that the error rate e is statistically proportional 
to the ratio of the illegitimate states among the n checked 
pairs. Alice and Bob abort the protocol if the measured 
error rate e is larger than a threshold for checking, e c heck- 
The threshold for checking, e c heck, is set to be a little bit 
smaller than a threshold for error correction e cor . , to com- 
pensate for statistical fluctuations. Let us assume that 
the number of illegitimate states in the state in Eq. © is 
larger than (2n)(2e cor .). Since the probability that each 
illegitimate state is detected in the checking procedure is 
equal to or larger than 1/2, as seen above, it typically 
give rise to an error rate larger than e cor . for the checked 
pairs. Then, the probability that the state passes the 
test is negligibly small. In other words, the checking pro- 
cedure sifts out, with high probability, any state that 
contains more than 4ne cor . pairs of illegitimate states. 
Combining this fact with Bayes's theorem, we get the 
following: Whatever state in Eq. Eve has prepared, 
if the state passes the test with a non-negligible proba- 
bility, then the ratio of illegitimate states of the resultant 
state is less than 2e cor . with high probability. Therefore, 
if they choose a QECC that can correct up to an error 
rate 2e cor ., the final state after quantum error correction 
by using the chosen code will have a high fidelity to the 
legitimate state. 



III. SECURITY CRITERION AND EVE'S 
REFINED INFORMATION 

Let us now discuss the security criterion. What has 
been considered so far is Eve's viewpoint: The higher 
the probability to pass the test by Alice and Bob, the 
less the information that Eve gets is. However, what 
we actually need is the security criterion for Alice and 
Bob, the users. It is intuitively clear that the security 
criterion for Eve can be translated to that for Alice and 
Bob. However, there remain a few difficulties in doing 
so because Alice and Bob do not know the initial state 
that Eve knows. Eve's most general strategy is to pre- 
pare a state in Eq. (0J with a probability distribution 
P{/.}'s. Once Alice and Bob know the probability distri- 
bution P{ fc -j's, combined with the Bayes's theorem, they 
can calculate the final state. However, the problem is 



that it is not clear what probability distribution P{fc}'s 
Eve will choose. However, we can say that Eve will op- 
timize her strategy. That is, she will choose an attack 
that maximizes her information on the key among those 
with the same probability to pass the test. Identification 
of the optimal probability distribution P{fc}'s seems to 
be at heart of the open problem, to find a clear security 
criterion for Alice and Bob [||. 

However, a certain probability distribution P{fc}'s has 
been tacitly assumed in discussions on QKD so far. For 
example, let us consider the case where Eve chooses an 
attack that can give her full information on the key once 
it pass the test, but the probability to pass the test is 
negligible. That is, she chooses that P{ fe } 7^ for only 
those {fc}'s in which most of ki are nonzero. If Alice and 
Bob assume that Eve adopts this strategy, combined with 
the Bayes's theorem, their conclusion is always that Eve 
has full information. However, this is not regarded as a 
strategy that Eve will actually adopt because it blocks 
communication between Alice and Bob. Here we accept 
that it is not a good strategy for Eve. Here, we do not 
try to get a rigorous security criterion. It may be a very 
subtle problem to find Eve's optimal strategy because it 
may depend on the real situations in which Alice, Bob, 
and Eve find themselves. However, it is reasonable to 
say that Eve's optimal strategy is such that Alice and 
Bob get a state pab that is almost a legitimate state as 
a result of the EDP, as assumed so far. 

The situation we meet here is that Alice and Bob have 
only partial information on the state for which Eve has 
full information. That is, we have 

PAB = ^Pitl'EiPABE) = ( 7 ) 

i i 

Here, Pabe denotes a (pure) state inferred from 
Eve's classical information i. Consider a case where 
F(p AB , |$)® fe ) > 1 - e with F denoting the fidelity [HI 
and e being a positive real number. Let us see how Eve's 
refined knowledge on the state is not so helpful to her by 
using the following two arguments. 

Let us give the first argument. For each p % ABEl Eve's 
state is given by p l E = tr ab(p"abe)> and s (Pe) = s (Pab) 
because Pabe IS a pure state. Then, the mutual infor- 
mation between Eve's party and Alice and Bob's party, 
P(AB;E), is bounded by the S(p AB ). However, we can 
see that 

1 - e < F(pab, m® k ) = £>P(pU \®)® k ) (8) 

i 

by using Eq. J7J and the relation F(J2iPiP z , — 
TliPiF{p l , IV'))- Equation JSJl says that the average of 
the fidelities of p\ B is bounded by a quantity 1 — e that 
bounds the fidelity of the average (mixed) state pab- 
Here, Eve cannot control the outcome of the classical 
information i. Thus, it is a meaningful average even 
if Eve knows the i. More concretely, let us consider a 
particular F{p l ABl |$)® fc ). From Eq. ©, we have that 
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{1 — F(p l AB , |$)® fc )}pi > e, which expresses a reciprocal 
relation between the closeness of the state to legitimate 
states and a probability that it happens. 

Let us give the second argument. Consider a purifica- 
tion of the state pab 

Wabe)=Y.Vp~SWabe) (9) 

i 

that is compatible with Eq. 10. Here, \'*Pabe)(' 1 I } abe\ = 
Pab Ei an d the qubits storing the classical information i 
are at Eve's hands. If Eve first performs a measurement 
on qubits storing the i, then the state reduces to p\ BE 
with probability pi. The situation now is equivalent to 
the case above where Eve has the state Pabe with knowl- 
edge of the i. However, in this case the bound in Eq. (0 
is valid for the pure state \iPabe)- Therefore, we can say 
that the bound in Eq. © applies to the case where Eve 
has more refined information i about the final state. 



IV. EQUIVALENCE OF THE BELL AND THE 
LOCAL MEASUREMENTS 

Now let us discuss the problem of partial equivalence. 
So far, we have assumed that Alice and Bob can per- 
form Mz and Mx- However, they are nonlocal mea- 
surements that cannot be actually done by Alice and 
Bob, as seen above. Their argument for this problem 
is the following 0, 0, IE : Let us consider the actual 
situation where Alice and Bob each perform Z measure- 
ments on a pair of qubits. The basis for this measure- 
ment is |00), |01), 1 10), and |11). By Eq. ©, however, 
we can estimate the probabilities involved with the Mz 
measurement solely from the outcomes of the Z mea- 
surement: For example, tr{p(|<I> + )($ + | + |$~)($~ |)} = 
tr{p(|00)(00| + |11)(11|)} - tr(p|00)(00|) + tr(p|ll)(ll|). 
The same thing can be said for the Mx and the X mea- 
surements. However, the measured (or checked) n pairs 
are not further used by Alice and Bob. Only the re- 
maining n information pairs are used for key generation. 
That is, the checked and the information pairs are differ- 
ent. Therefore, the density operator for the information 
pairs is invariant to whatever measurement they do on 
the checked pairs, provided that they do not make use of 
the information on their measurements outcomes. (One's 



quantum state can depend on his/her knowledge about 
the measurement outcomes on the other side when the 
shared initial state is entangled, as is well known.) Alice 
and Bob may not make use of the information on the 
measurement outcomes. Therefore, if the error rate 
estimated by the local measurements Z and X is below 
the threshold for checking e c /j ec fc,the EDP will be success- 
ful with high probability: The fact that is less than 
e c heck implies that if they had estimated the error rate e b 
by performing the nonlocal measurement Mz and Mx, 
then they also would have found that was less than 
Scheck with high probability. However, as we have seen 
above, if es is less than e c heck, then the EDP is successful 
with high probability. 

However, the measurement outcomes are publicly an- 
nounced in the protocol; thus, Eve knows it. The problem 
is that Eve can make use of the information on the mea- 
surement outcomes. Our solution to this problem is the 
following: The best thing that Eve can get is the refined 
knowledge on the final state, however, and we have seen 
above that such refined information is not so helpful to 
Eve. Therefore, now we can safely say that the local Z 
and X measurements are equivalent to the nonlocal Mz 
and Mx measurements as far as the security of BB84 
protocol is concerned. 



V. CONCLUSION 

To summarize, we reformulated the modified LC pro- 
tocol and arguments for its security in an explicit man- 
ner. While discussing the security criterion for Alice and 
Bob briefly, we showed that Eve's refined information on 
the final state is not helpful to her. Then, we argued that 
current discussions on the equivalence of the Bell and the 
local measurements are not clear, and we showed that the 
problem of the equivalence can be resolved using the fact 
that Eve's refined information is not helpful to her. 
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